dissect.cobaltstrike 1.1.1.dev7__tar.gz → 1.2.1.dev1__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (66) hide show
  1. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/PKG-INFO +1 -1
  2. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/_version.py +2 -2
  3. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/beacon.py +1 -1
  4. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/test_beacon.py +12 -0
  5. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/.github/workflows/dissect-ci.yml +0 -0
  6. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/.gitignore +0 -0
  7. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/.lfs-assets-id +0 -0
  8. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/.pre-commit-config.yaml +0 -0
  9. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/.readthedocs.yml +0 -0
  10. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/LICENSE +0 -0
  11. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/README.rst +0 -0
  12. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/codecov.yml +0 -0
  13. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/__init__.py +0 -0
  14. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/artifact.py +0 -0
  15. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/c2.py +0 -0
  16. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/c2profile.lark +0 -0
  17. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/c2profile.py +0 -0
  18. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/c_c2.py +0 -0
  19. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/client.py +0 -0
  20. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/pcap.py +0 -0
  21. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/pe.py +0 -0
  22. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/utils.py +0 -0
  23. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/version.py +0 -0
  24. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/xordecode.py +0 -0
  25. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/Makefile +0 -0
  26. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/c2profile-grammar.rst +0 -0
  27. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/codespell-ignore-words.txt +0 -0
  28. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/conf.py +0 -0
  29. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/examples.rst +0 -0
  30. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/images/beacon-client.png +0 -0
  31. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/images/teamserver-echoclient.png +0 -0
  32. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/images/teamserver_ls.png +0 -0
  33. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/images/vt-cobaltstrike-43-zip.png +0 -0
  34. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/index.rst +0 -0
  35. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/installation.rst +0 -0
  36. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/license.rst +0 -0
  37. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/scripts/checksum8-accesslogs.rst +0 -0
  38. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/scripts/dump_beacon_keys.rst +0 -0
  39. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/scripts/example_client.rst +0 -0
  40. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/scripts/index.rst +0 -0
  41. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/structures/c2_def.rst +0 -0
  42. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/structures/cs_def.rst +0 -0
  43. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/structures/index.rst +0 -0
  44. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/structures/pe_def.rst +0 -0
  45. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/tools/beacon-artifact.rst +0 -0
  46. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/tools/beacon-client.rst +0 -0
  47. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/tools/beacon-dump.rst +0 -0
  48. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/tools/beacon-pcap.rst +0 -0
  49. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/tools/beacon-xordecode.rst +0 -0
  50. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/tools/c2profile-dump.rst +0 -0
  51. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/tutorials/decrypt_cobaltstrike_pcaps.rst +0 -0
  52. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/tutorials/index.rst +0 -0
  53. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/docs/tutorials/minimal_beacon_client.rst +0 -0
  54. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/pyproject.toml +0 -0
  55. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/scripts/checksum8-accesslogs.py +0 -0
  56. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/scripts/dump_beacon_keys.py +0 -0
  57. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/scripts/example_client.py +0 -0
  58. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/conftest.py +0 -0
  59. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/test_c2.py +0 -0
  60. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/test_c2profile.py +0 -0
  61. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/test_client.py +0 -0
  62. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/test_pe.py +0 -0
  63. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/test_utils.py +0 -0
  64. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/test_version.py +0 -0
  65. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/test_xordecode.py +0 -0
  66. {dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tox.ini +0 -0
{dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.3
2
2
  Name: dissect.cobaltstrike
3
- Version: 1.1.1.dev7
3
+ Version: 1.2.1.dev1
4
4
  Summary: a Python library for dissecting Cobalt Strike related data
5
5
  Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
6
6
  Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
{dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/_version.py RENAMED
@@ -12,5 +12,5 @@ __version__: str
12
12
  __version_tuple__: VERSION_TUPLE
13
13
  version_tuple: VERSION_TUPLE
14
14
 
15
- __version__ = version = '1.1.1.dev7'
16
- __version_tuple__ = version_tuple = (1, 1, 1, 'dev7')
15
+ __version__ = version = '1.2.1.dev1'
16
+ __version_tuple__ = version_tuple = (1, 2, 1, 'dev1')
{dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/dissect/cobaltstrike/beacon.py RENAMED
@@ -794,7 +794,7 @@ class BeaconConfig:
794
794
  for setting in self.settings_tuple:
795
795
  val = setting.value
796
796
  if index_type == "name":
797
- key = setting.index.name
797
+ key = setting.index.name or str(setting.index)
798
798
  elif index_type == "const":
799
799
  key = setting.index.value
800
800
  else:
{dissect_cobaltstrike-1.1.1.dev7 → dissect_cobaltstrike-1.2.1.dev1}/tests/test_beacon.py RENAMED
@@ -311,3 +311,15 @@ def test_beacon_domains_punycode(punycode_beacon_file):
311
311
  assert bconfig.domains == ["kçi.com"]
312
312
  assert bconfig.domains[0].encode("idna") == b"xn--ki-4ia.com"
313
313
  assert b"k\xe7i.com" in bconfig.raw_settings["SETTING_DOMAINS"]
314
+
315
+
316
+ def test_beacon_setting_unknown_enum():
317
+ setting = (
318
+ beacon.cs_struct.uint16(6969).dumps(),
319
+ beacon.SettingsType.TYPE_PTR.dumps(),
320
+ beacon.cs_struct.uint16(3).dumps(),
321
+ b"foo",
322
+ )
323
+ config = beacon.BeaconConfig(b"".join(setting))
324
+ assert None not in config.settings
325
+ assert dict(config.settings) == {"BeaconSetting.6969": b"foo"}